Zebra CVE-2026-104431

The Zebra node must accept inbound peer-to-peer connections and participate in mempool transaction relay (the default operating mode for a full node on the network), and it must be running a version before 6.0.0. The specific trigger is submission of non-standard, high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() synchronous script verification before standardness filtering rejects them. No authentication, no user interaction, and no non-default configuration are required (PR:N/UI:N). The main limiting factors are that impact is confined to availability (no data exposure or code execution) and that only reachable, unpatched Zebra nodes are affected; nodes not accepting inbound connections or already on 6.0.0+ are not exposed.

This is a credible availability threat with moderate priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms the strongest exploitation signals: network-reachable, low complexity, no authentication, and no user interaction, meaning any peer that can open a connection to the node can attempt it. Impact is scoped strictly to availability (VA:H, with VC:N/VI:N/VA:H) - there is no confidentiality or integrity compromise, so this is a resource-exhaustion DoS (CWE-405) rather than a code-execution or data-breach issue, which caps its true severity below the raw 8.7 number for most risk models. No EPSS score, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified from probabilistic data; absence of these is not evidence they do not exist, only that they were not supplied. The vulnerability was reported by VulnCheck (a credible research source) and a vendor patch exists, which raises the realism of eventual public exploit development. Net: a real and easily triggerable DoS against reachable Zebra nodes, but the single-impact-dimension nature and the niche deployment footprint of a Zcash node implementation temper the real-world blast radius compared to a ubiquitous-product critical.

An attacker opens an unauthenticated peer-to-peer connection to a reachable Zebra node (before 6.0.0) and floods it with non-standard, high-sigop P2SH transactions. Because these transactions reach CachedFfiTransaction::is_valid() and its expensive synchronous script verification before standardness checks can reject them, the attacker saturates the verifier buffer and stalls the Tokio async workers, rendering the node unresponsive. No public exploit identified at time of analysis, but the attack requires no authentication and only low complexity.